Aria Operations CVE-2026-22719: Exploited Command Injection

What to do

1. List every Aria Operations and VCF Operations node and record its version and build.
2. Upgrade 8.x to 8.18.7 and 9.x to 9.0.2.0 EP2 or 9.1.0.0; 8.18.6 and 9.0.2.0 are the minimum for this CVE.
3. If you cannot upgrade yet, run aria-ops-rce-workaround.sh from KB430349 as root on every node; it does not cover CVE-2026-22720 or CVE-2026-22721.
4. Do not start a support-assisted migration on an unpatched build, and keep the appliances reachable only from admin networks.
5. If a migration ran on an unpatched build, rotate the vCenter, cloud and adapter credentials stored in Aria Operations.

How to check if you are affected or compromised

• Find out whether a support-assisted migration ran on any node before it reached 8.18.6 or 9.0.2.0, and whether untrusted networks could reach it at the time.
• On each node, review root's crontab, /etc/cron.d, authorized_keys and recent logins (last -a) for anything you did not set up.
• Check firewall logs for unexpected outbound connections from Aria Operations appliances.
• Review vCenter events for unusual actions by the account Aria Operations uses; Broadcom had published no IOCs as of Oct 23, 2026.

What happened#

On February 24, 2026, Broadcom published VMSA-2026-0001 and released VMware Aria Operations 8.18.6. The advisory fixes three bugs. The serious one is CVE-2026-22719, a command injection (CWE-77). Broadcom says an unauthenticated attacker "may exploit this issue to execute arbitrary commands which may lead to remote code execution in VMware Aria Operations while support-assisted product migration is in progress." Broadcom scores it CVSS 3.1 8.1. The high attack complexity reflects that migration condition. The other two are a stored XSS (CVE-2026-22720) and a privilege escalation (CVE-2026-22721), which need a login.

On March 3, Broadcom updated the advisory: it "is aware of reports of potential exploitation of CVE-2026-22719 in the wild," but cannot independently confirm them. CISA added the CVE to the KEV catalog the same day, with a March 24 deadline. SecurityWeek found no public information about the attacks and said it was unclear whether the bug was used as a zero-day. No attacker, technique or indicator has been published as of October 23, 2026.

Who is affected#

Per the CVE record and NVD: Aria Operations 8.x before 8.18.6, VCF Operations 9.0 before 9.0.2.0, and VCF 4.x and 5.x before 5.2.3, plus Telco Cloud Platform and Telco Cloud Infrastructure. Field Effect explains the condition: support-assisted migration is a workflow run with VMware Support that turns on components that are normally inactive, and the vulnerable code is reachable only while it runs.

Do you really need to act?#

Check, don't panic. Most appliances are never in a migration, and the fix is eight months old. But Aria Operations stores credentials for vCenter and the other systems it monitors, so a foothold there reaches far. Two more points matter. First, VMSA-2026-0004 (June 8, 2026) fixed three stored XSS bugs scored 8.0. The full 8.x fix is 8.18.7, so 8.18.6 is no longer the target. Second, the product already had a KEV entry: CVE-2025-41244, a local privilege escalation in Aria Operations and VMware Tools, fixed in 8.18.5 and in KEV since October 2025.

What to do now#

1. List every Aria Operations and VCF Operations node and its version and build.
2. Upgrade to 8.18.7, or to 9.0.2.0 EP2 or 9.1.0.0 on 9.x. The 8.18.6 release notes say to run the Pre-Upgrade Assessment Tool and snapshot each node first.
3. If an upgrade must wait, copy aria-ops-rce-workaround.sh from KB430349 to each node, then run chmod a+x ./aria-ops-rce-workaround.sh && ./aria-ops-rce-workaround.sh as root. Broadcom calls it temporary.
4. Patch before any support-assisted migration, and limit appliance access to admin networks.

How to tell if you were hit#

Start with your change records: did a support-assisted migration run on a build older than 8.18.6 or 9.0.2.0, and could untrusted networks reach the appliance then? If so, check each node. Run crontab -l, ls -la /etc/cron.d, cat /root/.ssh/authorized_keys and last -a, and look for anything you did not set up. Review firewall logs for outbound connections from the appliances, and vCenter events for unusual actions by the Aria Operations service account. If anything is off, rebuild the node and rotate every credential it stores.

Timeline#

• Feb 24, 2026 — Broadcom publishes VMSA-2026-0001 and Aria Operations 8.18.6.
• Feb 25, 2026 — The CVE record is published.
• Mar 3, 2026 — Broadcom notes reports of exploitation. CISA adds the CVE to KEV.
• Mar 24, 2026 — CISA's deadline for federal agencies.
• Jun 8, 2026 — VMSA-2026-0004 ships further Aria Operations fixes, through 8.18.7.

Vulnerability records

• CVE-2026-22719 · KEV 2026-03-03 · VMware Aria Operations contains a command injection vulnerability.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Broadcom — VMSA-2026-0001: VMware Aria Operations updates address multiple vulnerabilities (CVE-2026-22719, CVE-2026-22720, CVE-2026-22721) support.broadcom.com
2. Broadcom — KB430349: Workaround instructions to address CVE-2026-22719 in Aria Operations 8.18.x and 9.0.x knowledge.broadcom.com
3. Broadcom — VMware Aria Operations 8.18.6 release notes techdocs.broadcom.com
4. CVE record — CVE-2026-22719 cve.org
5. NVD — CVE-2026-22719 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2026-22719 cisa.gov
7. Broadcom — VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities support.broadcom.com
8. CVE record — CVE-2025-41244 cve.org
9. Field Effect — CISA flags exploited RCE in VMware Aria Operations fieldeffect.com

Coverage and analysis

1. SecurityWeek — VMware Aria Operations vulnerability exploited in the wild securityweek.com